api-testing-mcp

Purpose

api-testing-mcp is a complete API testing MCP server, not just a request sender, but a full testing workbench. Through natural language conversation, it can complete HTTP requests, assertion verification, multi-step flows, OpenAPI import, mock data, load testing, response diff comparison, batch test runs, reusable collections, and environment management. No account required, no cloud sync, no files generated, everything runs inline and is stored as pure JSON.

Main capabilities

• HTTP requests: supports GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, with configurable request headers, query parameters, JSON bodies, Bearer / API Key / Basic authentication, and custom timeouts; relative URLs are automatically resolved based on BASE_URL; supports {{variable}} interpolation.
• Compression mode: returns compressed responses by default, which can reduce tokens by 70–95%. Three modes: minimal (only status, duration, size, and the first 200 characters of the body, saving about 95%), normal (default, filters response headers and truncates the body to max_body_bytes, saving about 75%), full (complete response). Compressed responses include a call_id, and the full body can be restored with inspect_last_response({ call_id }) without re-requesting; responses are kept in a 20-slot ring buffer and persisted to .api-testing/last-responses/, with a TTL of 1 hour. only_fields supports dot paths, array indices, and wildcards (such as items[*].name), returning only the specified fields.
• Assertions: validate responses with structured pass/fail results, providing 10 operators: eq, neq, gt, gte, lt, lte, contains, not_contains, exists, type.
• Flows: chain requests through variable extraction, suitable for authentication flows and CRUD sequences.
• OpenAPI: import JSON/YAML specifications from a URL or local file, supporting OpenAPI 3.x (full $ref resolution, allOf, oneOf, anyOf), with partial support for OpenAPI 2.0. After import, the AI knows every endpoint, parameter, and schema.
• Mock data: Generate realistic fake data based on OpenAPI schemas, respecting types, formats (email, uuid, date-time), enums, and required fields.
• Load testing: Fire N concurrent requests and get performance metrics (including percentile metrics).
• Response diffing: Execute two requests and compare responses field by field to detect regressions or compare environments.
• Batch testing: Run all saved requests in a collection (or filter by tag) and get a summary.
• Collections and tags: Save requests for reuse, with support for tags and regression suites.
• Environments: Manage variables (BASE_URL, tokens, API keys), isolated by context. Core concepts include groups (organize environments and bind them to directories; a group has N scopes sharing environments, with exactly one default environment; when entering a scope of the group its environment is automatically available), default environment (activated automatically when entering the scope, persists across sessions), active environment (currently used for variable resolution; starts as the default when entering the scope, can be switched at any time, resets to default when the session ends). The global environment must be explicitly activated with env_switch and does not persist across sessions. Variables are automatically interpolated into URLs, headers, query parameters, and request bodies.
• Credential security: Credentials never leave the local machine; environment files are plain JSON stored in ~/.api-testing/, not synced to the cloud, not embedded in exports, and not tracked by git.
• Postman import/export: Bidirectional support for Postman v2.1. When importing collections, folders become tags, authentication is inherited from folder/collection levels, and raw JSON, x-www-form-urlencoded, and form-data bodies are supported; when importing environments, currentValue is preferred over value, disabled variables are skipped, and activate is optional. When exporting collections, they are grouped into folders by tag, authentication is mapped to Postman native format, and {{variables}} are preserved as-is; when exporting environments, all variables are enabled: true.
• Native import/export: Export collections and environments as a portable .atm/ folder for easy sharing or copying across projects; on first export, .atm/ is automatically added to .gitignore.
• cURL export: Convert saved requests into cURL commands that can be pasted directly (variables resolved).

Usage

Installation: Add the server configuration to each MCP client's configuration file. On macOS, the Claude configuration is located at ~/Library/Application Support/Claude/claude_desktop_config.json, and on Windows at %APPDATA%\Claude\claude_desktop_config.json; for Cursor / Windsurf, add it to .cursor/mcp.json or .windsurf/mcp.json in the project root; for VS Code, add it to .vscode/mcp.json; for Codex CLI (OpenAI), it can be added to ~/.codex/config.toml; for Gemini CLI, add it to ~/.gemini/settings.json. Workflow: After installation, create an environment so that relative paths resolve automatically; if you have a Swagger/OpenAPI specification, import it; use "List my environments" to verify that the environment you just created is visible. After that, describe your needs directly in natural language, and the AI will choose the appropriate tools.

Storage and Architecture

Everything is local, with no database, no cloud sync, and no telemetry. All data is stored as plain JSON in ~/.api-testing/ and can be read, backed up, or deleted at any time. Global storage is used for credentials, and the .atm/ exported to the project root does not contain credentials and can be shared safely. The default storage path can be overridden via API_TESTING_DIR; if overridden to inside a git repository, .api-testing/ must be added to .gitignore. Tech stack: TypeScript (strict), MCP SDK, Zod, Vitest, tsup. MIT license.

Use Cases and Limitations

Suitable for developers who need AI-assisted API testing and debugging, supporting any MCP client. Note that each registered MCP incurs a fixed overhead of about 300–600 tokens per session, and usually 1–2 real calls per session are enough to break even; the global environment must be explicitly activated and does not persist; OpenAPI 2.0 is only partially supported. Information such as the product's pricing, price, and platforms has not yet been provided.